Analysis
-
max time kernel
146s -
max time network
169s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
21-10-2021 05:20
Static task
static1
Behavioral task
behavioral1
Sample
P. Order & Contract (A-4553) PDF.exe
Resource
win7-en-20210920
General
-
Target
P. Order & Contract (A-4553) PDF.exe
-
Size
388KB
-
MD5
2b7aa1c3ad41c61590c7e8788717f3a3
-
SHA1
b25e8d174baa57079f2886d76ccf45248269d5d3
-
SHA256
4d9cbe2a33087ef1552af182cd03bbbe5bba8d01f5eb11c25c3eb3eb72008a7c
-
SHA512
67939ee05ad3baf7115f46cc85fabcff97b65836dd7ef8eedbfa9b114adca3376152bf00db3bf4d47976287b1d0ba1ed1960f036043fab392e5784a637f30084
Malware Config
Extracted
xloader
2.5
r3n5
http://www.keeyasmarketplace.com/r3n5/
peterjhill.com
bleednavy.com
a6d83.top
koudoula.store
albawardl.com
j-sdigitalekuns.net
0wzr2dglc.com
xd16880.com
safepostcourier.com
seuic.net
hainansousou.com
meuexamor.com
strategicthinking.coach
tabliqatbama.com
kidzplan.com
non-toxicnailpolish.com
bwgds.com
behindhereyesphotography.com
age-oldpklduy.xyz
lesconfidentialistes.paris
cornerstonepartners.online
bumidustores.com
vokalsnarbh.quest
regensburg-ferienwohnung.com
rogue-gear.com
blighttest.club
elephantspublications.online
locoboysco.com
nbl20.com
harunerdal.xyz
nailsofts.com
zhangyi.photography
farmavidacanarias.com
szqyuanzishi.com
governorslounge.net
bisoubox.com
fcjoke.com
talmkt.com
christinesyquia.com
lozanoygarcia.com
peolinkbroker.com
doskimen.art
wealth-mindset.com
covapa2.com
montclairbehavioral.com
atletofficial.com
endeavorgroupllc.net
kczu.net
beputis4.com
yshowmedia.com
steelresearchcentre.com
hpywk.com
realprestige.online
brightonpeople.com
wittig-technologies.com
sddn30.xyz
kungfupimps.com
xn--299akkrtr22f.com
lxrh.net
apexmakaluhydropower.com
mcpaintingco.com
nchh40.xyz
gwmetaverse.com
zakawsky.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1440-61-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1440-62-0x000000000041D4C0-mapping.dmp xloader behavioral1/memory/1228-69-0x00000000000D0000-0x00000000000F9000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1096 cmd.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
P. Order & Contract (A-4553) PDF.exeP. Order & Contract (A-4553) PDF.exeNAPSTAT.EXEdescription pid process target process PID 1616 set thread context of 1440 1616 P. Order & Contract (A-4553) PDF.exe P. Order & Contract (A-4553) PDF.exe PID 1440 set thread context of 1336 1440 P. Order & Contract (A-4553) PDF.exe Explorer.EXE PID 1228 set thread context of 1336 1228 NAPSTAT.EXE Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
P. Order & Contract (A-4553) PDF.exeNAPSTAT.EXEpid process 1440 P. Order & Contract (A-4553) PDF.exe 1440 P. Order & Contract (A-4553) PDF.exe 1228 NAPSTAT.EXE 1228 NAPSTAT.EXE 1228 NAPSTAT.EXE 1228 NAPSTAT.EXE 1228 NAPSTAT.EXE 1228 NAPSTAT.EXE 1228 NAPSTAT.EXE 1228 NAPSTAT.EXE 1228 NAPSTAT.EXE 1228 NAPSTAT.EXE 1228 NAPSTAT.EXE 1228 NAPSTAT.EXE 1228 NAPSTAT.EXE 1228 NAPSTAT.EXE 1228 NAPSTAT.EXE 1228 NAPSTAT.EXE 1228 NAPSTAT.EXE 1228 NAPSTAT.EXE 1228 NAPSTAT.EXE 1228 NAPSTAT.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
P. Order & Contract (A-4553) PDF.exeNAPSTAT.EXEpid process 1440 P. Order & Contract (A-4553) PDF.exe 1440 P. Order & Contract (A-4553) PDF.exe 1440 P. Order & Contract (A-4553) PDF.exe 1228 NAPSTAT.EXE 1228 NAPSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
P. Order & Contract (A-4553) PDF.exeNAPSTAT.EXEdescription pid process Token: SeDebugPrivilege 1440 P. Order & Contract (A-4553) PDF.exe Token: SeDebugPrivilege 1228 NAPSTAT.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1336 Explorer.EXE 1336 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1336 Explorer.EXE 1336 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
P. Order & Contract (A-4553) PDF.exeExplorer.EXENAPSTAT.EXEdescription pid process target process PID 1616 wrote to memory of 1440 1616 P. Order & Contract (A-4553) PDF.exe P. Order & Contract (A-4553) PDF.exe PID 1616 wrote to memory of 1440 1616 P. Order & Contract (A-4553) PDF.exe P. Order & Contract (A-4553) PDF.exe PID 1616 wrote to memory of 1440 1616 P. Order & Contract (A-4553) PDF.exe P. Order & Contract (A-4553) PDF.exe PID 1616 wrote to memory of 1440 1616 P. Order & Contract (A-4553) PDF.exe P. Order & Contract (A-4553) PDF.exe PID 1616 wrote to memory of 1440 1616 P. Order & Contract (A-4553) PDF.exe P. Order & Contract (A-4553) PDF.exe PID 1616 wrote to memory of 1440 1616 P. Order & Contract (A-4553) PDF.exe P. Order & Contract (A-4553) PDF.exe PID 1616 wrote to memory of 1440 1616 P. Order & Contract (A-4553) PDF.exe P. Order & Contract (A-4553) PDF.exe PID 1336 wrote to memory of 1228 1336 Explorer.EXE NAPSTAT.EXE PID 1336 wrote to memory of 1228 1336 Explorer.EXE NAPSTAT.EXE PID 1336 wrote to memory of 1228 1336 Explorer.EXE NAPSTAT.EXE PID 1336 wrote to memory of 1228 1336 Explorer.EXE NAPSTAT.EXE PID 1228 wrote to memory of 1096 1228 NAPSTAT.EXE cmd.exe PID 1228 wrote to memory of 1096 1228 NAPSTAT.EXE cmd.exe PID 1228 wrote to memory of 1096 1228 NAPSTAT.EXE cmd.exe PID 1228 wrote to memory of 1096 1228 NAPSTAT.EXE cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\P. Order & Contract (A-4553) PDF.exe"C:\Users\Admin\AppData\Local\Temp\P. Order & Contract (A-4553) PDF.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\P. Order & Contract (A-4553) PDF.exe"C:\Users\Admin\AppData\Local\Temp\P. Order & Contract (A-4553) PDF.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\NAPSTAT.EXE"C:\Windows\SysWOW64\NAPSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\P. Order & Contract (A-4553) PDF.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1096-70-0x0000000000000000-mapping.dmp
-
memory/1228-72-0x0000000001D80000-0x0000000001E10000-memory.dmpFilesize
576KB
-
memory/1228-71-0x0000000001F10000-0x0000000002213000-memory.dmpFilesize
3.0MB
-
memory/1228-69-0x00000000000D0000-0x00000000000F9000-memory.dmpFilesize
164KB
-
memory/1228-68-0x0000000000930000-0x0000000000976000-memory.dmpFilesize
280KB
-
memory/1228-67-0x0000000000000000-mapping.dmp
-
memory/1336-66-0x0000000006E70000-0x0000000006F78000-memory.dmpFilesize
1.0MB
-
memory/1336-73-0x0000000008BB0000-0x0000000008CF5000-memory.dmpFilesize
1.3MB
-
memory/1440-62-0x000000000041D4C0-mapping.dmp
-
memory/1440-65-0x0000000000190000-0x00000000001A1000-memory.dmpFilesize
68KB
-
memory/1440-64-0x00000000008C0000-0x0000000000BC3000-memory.dmpFilesize
3.0MB
-
memory/1440-61-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1440-60-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1440-59-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1616-53-0x0000000000100000-0x0000000000101000-memory.dmpFilesize
4KB
-
memory/1616-58-0x0000000005B10000-0x0000000005B5B000-memory.dmpFilesize
300KB
-
memory/1616-57-0x0000000000630000-0x0000000000637000-memory.dmpFilesize
28KB
-
memory/1616-56-0x0000000004A50000-0x0000000004A51000-memory.dmpFilesize
4KB
-
memory/1616-55-0x0000000075BF1000-0x0000000075BF3000-memory.dmpFilesize
8KB